How to Recover Trust After an Identity Breach

George Firican interviews Chris Bevil, former CISO and principal consultant at Commvault, about identity resilience—recovering to a clean, trusted state after an identity attack succeeds. They discuss why identity has become a primary target as cloud/SaaS, hybrid work, federation, and AI agents expand the attack surface and speed of compromise. Using examples like the Change Healthcare incident and an incident-response case where attackers stole session tokens, escalated privileges, created privileged accounts, and disabled defenses, they emphasize business impact, downtime, and loss of trust. Chris Bevil argues teams must break silos, define minimum viable operations, and technically test recovery in small chunks. He outlines Commvault’s pillars: assess attack paths and exposures, detect with continuous visibility, recover precisely (down to objects like users/groups), and keep tools/procedures accessible, stressing evidence-based readiness over tabletop-only plans.